dd62a71902112f13358d8052f2aae7fe7a1dcec6e3ba77b1c70fdc4b4584e2b0

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19-04-2024 07:57

Target

Detector/Ccb_detect_hdzb.dll
Size

46KB
MD5

3e3549558c1a677a95c2582009d6608e
SHA1

4152ad9e18811b649c293b2b3ee23d6f9c1a2742
SHA256

b201f01f36a1b8a28de27800d0f49e0228bc86b106b0bdec61d91a4d24057f9d
SHA512

4e0379d29eb43e7e2e6d61076e056e17fad7148846de89a2ef3796c29e3bbfa7506230f6a47a7ef4b89c40ce74adaafb5fd77a22deed0dd4b8df0958012e0630
SSDEEP

768:ONxU1gvh6Zu2gQRlvkV4M7rzsBg50JtET9SpqJaSW6iuc46/:ONxAJEHYlMV3zsBgeJtKgqJaSW6iCA

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 816 wrote to memory of 840	816	rundll32.exe	85
PID 816 wrote to memory of 840	816	rundll32.exe	85
PID 816 wrote to memory of 840	816	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Detector\Ccb_detect_hdzb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:816
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Detector\Ccb_detect_hdzb.dll,#1
  2⤵
  PID:840